Eric,
The short answer to your question is that each CA is supposed to ensure
that the certs it issues match its allocation database. This applies to
both cert issuance and cert revocation. A quick look at the RPKI RFCs
provides a few examples of statements about the RPKI consistency model.
Steve
-----
RFC 6487 (Certificate Profile)
Intro:
Resource certificates are to be used in a manner that is consistent
with the RPKI Certificate Policy (CP) [RFC6484].*They are issued by*
*entities that assign and/or allocate public INRs, and thus the RPKI*
*is aligned with the public INR distribution function.*
*The specific goal for the associated RPKI is to precisely match the INR*
*allocation structure through an aligned certificate structure*
*that describes the allocation and its context within the INR*
*distribution hierarchy.*
RFC 6484 (RPKI CP)
Overview
*This PKI is designed to support validation of claims by current*
*holders of INRs, in accordance with the records of the organizations*
*that act as Certification Authorities (CAs) in this PKI.*
**
Section 3.3.2.Identification and Authentication for Re-Key after Revocation
*Each CA operating within the context of this PKI MUST employ*
*procedures to ensure that each certificate it issues accurately*
*reflects its records with regard to the organization to which the CA*
*has distributed the INRs identified in the certificate.**The specific*
*procedures employed for this purpose MUST be described by the CPS for*
*each CA.*
Section 3.4.Identification and Authentication for Revocation Request
Each CA operating within the context of this PKI MUST employ
procedures to ensure that:
*oan organization requesting revocation is the legitimate holder of*
*the certificate to be revoked.*
o*each certificate it revokes accurately reflects its records with*
*regard to the organization to which the CA has distributed the*
*INRs identified in the certificate*.
Section 4.2.2.Approval or Rejection of Certificate Applications
*Certificate applications MUST be approved based on the normal*
*business practices of the entity operating the CA, based on the CA's*
*records of INR holders.*
Indeed, I vaguely recall some conversations (on the list?) about the specific
consistency model that the RPKI is trying to achieve. I wasn't able to unearth
the thread, but what was the conclusion? That is, what is the consistency
model that the RPKI design team is striving for?
Thanks,
Eric
_______________________________________________
sidr mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/sidr
